Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:31
Behavioral task
behavioral1
Sample
067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe
-
Size
90KB
-
MD5
067009eb5c6559e6d6fa5b7640d84620
-
SHA1
3ba446bb810a904e62e1b6742910eff591aca8b2
-
SHA256
f95838ac13828054fd1afc507f3c91be1ef0b408d0730d2d9eaf7911a0e26e73
-
SHA512
eb5579d5f6c6f7479a6eb4f51b35b64f4086c968e8f85af29040aa1e5255894edd12775586f84a8d36773e55add087211c7920cc285ae9b914e385014cf48771
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpW:8hOmTsF93UYfwC6GIout0fmCiiiXA6mI
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-97-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3028-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-187-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2516-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-219-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2204-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-293-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon behavioral1/memory/1900-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/396-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-855-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1380-1067-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2420-1105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-1200-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2876-1225-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2000-1233-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1900-7697-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon behavioral1/memory/1900-8255-0x0000000077920000-0x0000000077A1A000-memory.dmp family_blackmoon behavioral1/memory/1900-8812-0x0000000077920000-0x0000000077A1A000-memory.dmp family_blackmoon behavioral1/memory/1900-9369-0x0000000077920000-0x0000000077A1A000-memory.dmp family_blackmoon behavioral1/memory/1900-11217-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon behavioral1/memory/1900-11999-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon behavioral1/memory/1900-15627-0x0000000077920000-0x0000000077A1A000-memory.dmp family_blackmoon behavioral1/memory/1900-15626-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon behavioral1/memory/1900-17381-0x0000000077A20000-0x0000000077B3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvdvd.exe1xxlllx.exe3fxlrfr.exe7tthth.exevvvjp.exe7vvdj.exexrfrflr.exebbbhtb.exevpvvp.exe7flxrfr.exe5tbhhh.exe3frrfrf.exebhhbnb.exeddpvj.exeddvjd.exefxrxlrx.exe5ttnhh.exepvddj.exe5lrxrxl.exe3btthb.exe1jdpj.exejddvd.exerrxrlxx.exethtbhn.exeddjdd.exeflrxxrx.exettntnn.exejjdjv.exe5lfflff.exefxlrrff.exenhhtbn.exepvdjp.exelfxfflr.exe9hhnbh.exe7bbbth.exe3jjdp.exellxfffl.exehbnbtb.exevpvdj.exebnhttt.exevpdpd.exe9ddpv.exe1rxlrrf.exebbbtbn.exetnnhhn.exevjpvd.exevpdpp.exefxrrxxf.exehbthbh.exebbbttb.exe7jjvj.exedppdd.exexrlrfrf.exetttnht.exedpjpp.exepjvdd.exe5lfllxl.exettbtbt.exebtbbth.exe9vpvv.exexflxfrf.exehbnhhh.exe1djdp.exe5pjvj.exepid process 2264 pvdvd.exe 632 1xxlllx.exe 2144 3fxlrfr.exe 2732 7tthth.exe 2692 vvvjp.exe 2652 7vvdj.exe 380 xrfrflr.exe 768 bbbhtb.exe 2556 vpvvp.exe 3004 7flxrfr.exe 3028 5tbhhh.exe 2624 3frrfrf.exe 2876 bhhbnb.exe 3000 ddpvj.exe 3020 ddvjd.exe 1296 fxrxlrx.exe 2004 5ttnhh.exe 1064 pvddj.exe 1716 5lrxrxl.exe 1652 3btthb.exe 1640 1jdpj.exe 1752 jddvd.exe 2516 rrxrlxx.exe 2384 thtbhn.exe 3068 ddjdd.exe 1776 flrxxrx.exe 1084 ttntnn.exe 2204 jjdjv.exe 1556 5lfflff.exe 1636 fxlrrff.exe 2120 nhhtbn.exe 936 pvdjp.exe 2332 lfxfflr.exe 2968 9hhnbh.exe 2224 7bbbth.exe 1800 3jjdp.exe 2296 llxfffl.exe 1900 hbnbtb.exe 2220 vpvdj.exe 1624 bnhttt.exe 1544 vpdpd.exe 2260 9ddpv.exe 2716 1rxlrrf.exe 2768 bbbtbn.exe 2668 tnnhhn.exe 2692 vjpvd.exe 2872 vpdpp.exe 2752 fxrrxxf.exe 2592 hbthbh.exe 2552 bbbttb.exe 2608 7jjvj.exe 2580 dppdd.exe 1884 xrlrfrf.exe 2804 tttnht.exe 2860 dpjpp.exe 2624 pjvdd.exe 2892 5lfllxl.exe 1996 ttbtbt.exe 2016 btbbth.exe 348 9vpvv.exe 1812 xflxfrf.exe 308 hbnhhh.exe 1808 1djdp.exe 2776 5pjvj.exe -
Processes:
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvd.exe upx behavioral1/memory/2264-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-3-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\1xxlllx.exe upx behavioral1/memory/2264-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/632-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3fxlrfr.exe upx behavioral1/memory/632-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tthth.exe upx behavioral1/memory/2732-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvjp.exe upx C:\7vvdj.exe upx behavioral1/memory/2652-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfrflr.exe upx behavioral1/memory/380-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbhtb.exe upx C:\vpvvp.exe upx behavioral1/memory/768-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7flxrfr.exe upx behavioral1/memory/3004-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5tbhhh.exe upx C:\3frrfrf.exe upx behavioral1/memory/3028-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhhbnb.exe upx C:\ddpvj.exe upx C:\ddvjd.exe upx behavioral1/memory/3000-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrxlrx.exe upx behavioral1/memory/1296-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ttnhh.exe upx behavioral1/memory/2004-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1296-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvddj.exe upx behavioral1/memory/2004-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrxrxl.exe upx behavioral1/memory/1716-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1064-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3btthb.exe upx C:\1jdpj.exe upx C:\jddvd.exe upx C:\rrxrlxx.exe upx behavioral1/memory/1752-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-196-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thtbhn.exe upx C:\ddjdd.exe upx C:\flrxxrx.exe upx behavioral1/memory/1084-220-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttntnn.exe upx C:\jjdjv.exe upx C:\5lfflff.exe upx behavioral1/memory/2204-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxlrrff.exe upx \??\c:\nhhtbn.exe upx behavioral1/memory/1636-250-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdjp.exe upx behavioral1/memory/2332-267-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2224-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1900-293-0x0000000077A20000-0x0000000077B3F000-memory.dmp upx behavioral1/memory/1900-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-306-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exepvdvd.exe1xxlllx.exe3fxlrfr.exe7tthth.exevvvjp.exe7vvdj.exexrfrflr.exebbbhtb.exevpvvp.exe7flxrfr.exe5tbhhh.exe3frrfrf.exebhhbnb.exeddpvj.exeddvjd.exedescription pid process target process PID 2420 wrote to memory of 2264 2420 067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe pvdvd.exe PID 2420 wrote to memory of 2264 2420 067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe pvdvd.exe PID 2420 wrote to memory of 2264 2420 067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe pvdvd.exe PID 2420 wrote to memory of 2264 2420 067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe pvdvd.exe PID 2264 wrote to memory of 632 2264 pvdvd.exe 1xxlllx.exe PID 2264 wrote to memory of 632 2264 pvdvd.exe 1xxlllx.exe PID 2264 wrote to memory of 632 2264 pvdvd.exe 1xxlllx.exe PID 2264 wrote to memory of 632 2264 pvdvd.exe 1xxlllx.exe PID 632 wrote to memory of 2144 632 1xxlllx.exe 3fxlrfr.exe PID 632 wrote to memory of 2144 632 1xxlllx.exe 3fxlrfr.exe PID 632 wrote to memory of 2144 632 1xxlllx.exe 3fxlrfr.exe PID 632 wrote to memory of 2144 632 1xxlllx.exe 3fxlrfr.exe PID 2144 wrote to memory of 2732 2144 3fxlrfr.exe 7tthth.exe PID 2144 wrote to memory of 2732 2144 3fxlrfr.exe 7tthth.exe PID 2144 wrote to memory of 2732 2144 3fxlrfr.exe 7tthth.exe PID 2144 wrote to memory of 2732 2144 3fxlrfr.exe 7tthth.exe PID 2732 wrote to memory of 2692 2732 7tthth.exe vvvjp.exe PID 2732 wrote to memory of 2692 2732 7tthth.exe vvvjp.exe PID 2732 wrote to memory of 2692 2732 7tthth.exe vvvjp.exe PID 2732 wrote to memory of 2692 2732 7tthth.exe vvvjp.exe PID 2692 wrote to memory of 2652 2692 vvvjp.exe 7vvdj.exe PID 2692 wrote to memory of 2652 2692 vvvjp.exe 7vvdj.exe PID 2692 wrote to memory of 2652 2692 vvvjp.exe 7vvdj.exe PID 2692 wrote to memory of 2652 2692 vvvjp.exe 7vvdj.exe PID 2652 wrote to memory of 380 2652 7vvdj.exe xrfrflr.exe PID 2652 wrote to memory of 380 2652 7vvdj.exe xrfrflr.exe PID 2652 wrote to memory of 380 2652 7vvdj.exe xrfrflr.exe PID 2652 wrote to memory of 380 2652 7vvdj.exe xrfrflr.exe PID 380 wrote to memory of 768 380 xrfrflr.exe bbbhtb.exe PID 380 wrote to memory of 768 380 xrfrflr.exe bbbhtb.exe PID 380 wrote to memory of 768 380 xrfrflr.exe bbbhtb.exe PID 380 wrote to memory of 768 380 xrfrflr.exe bbbhtb.exe PID 768 wrote to memory of 2556 768 bbbhtb.exe vpvvp.exe PID 768 wrote to memory of 2556 768 bbbhtb.exe vpvvp.exe PID 768 wrote to memory of 2556 768 bbbhtb.exe vpvvp.exe PID 768 wrote to memory of 2556 768 bbbhtb.exe vpvvp.exe PID 2556 wrote to memory of 3004 2556 vpvvp.exe 7flxrfr.exe PID 2556 wrote to memory of 3004 2556 vpvvp.exe 7flxrfr.exe PID 2556 wrote to memory of 3004 2556 vpvvp.exe 7flxrfr.exe PID 2556 wrote to memory of 3004 2556 vpvvp.exe 7flxrfr.exe PID 3004 wrote to memory of 3028 3004 7flxrfr.exe 5tbhhh.exe PID 3004 wrote to memory of 3028 3004 7flxrfr.exe 5tbhhh.exe PID 3004 wrote to memory of 3028 3004 7flxrfr.exe 5tbhhh.exe PID 3004 wrote to memory of 3028 3004 7flxrfr.exe 5tbhhh.exe PID 3028 wrote to memory of 2624 3028 5tbhhh.exe 3frrfrf.exe PID 3028 wrote to memory of 2624 3028 5tbhhh.exe 3frrfrf.exe PID 3028 wrote to memory of 2624 3028 5tbhhh.exe 3frrfrf.exe PID 3028 wrote to memory of 2624 3028 5tbhhh.exe 3frrfrf.exe PID 2624 wrote to memory of 2876 2624 3frrfrf.exe bhhbnb.exe PID 2624 wrote to memory of 2876 2624 3frrfrf.exe bhhbnb.exe PID 2624 wrote to memory of 2876 2624 3frrfrf.exe bhhbnb.exe PID 2624 wrote to memory of 2876 2624 3frrfrf.exe bhhbnb.exe PID 2876 wrote to memory of 3000 2876 bhhbnb.exe ddpvj.exe PID 2876 wrote to memory of 3000 2876 bhhbnb.exe ddpvj.exe PID 2876 wrote to memory of 3000 2876 bhhbnb.exe ddpvj.exe PID 2876 wrote to memory of 3000 2876 bhhbnb.exe ddpvj.exe PID 3000 wrote to memory of 3020 3000 ddpvj.exe ddvjd.exe PID 3000 wrote to memory of 3020 3000 ddpvj.exe ddvjd.exe PID 3000 wrote to memory of 3020 3000 ddpvj.exe ddvjd.exe PID 3000 wrote to memory of 3020 3000 ddpvj.exe ddvjd.exe PID 3020 wrote to memory of 1296 3020 ddvjd.exe fxrxlrx.exe PID 3020 wrote to memory of 1296 3020 ddvjd.exe fxrxlrx.exe PID 3020 wrote to memory of 1296 3020 ddvjd.exe fxrxlrx.exe PID 3020 wrote to memory of 1296 3020 ddvjd.exe fxrxlrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\067009eb5c6559e6d6fa5b7640d84620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\pvdvd.exec:\pvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\1xxlllx.exec:\1xxlllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\3fxlrfr.exec:\3fxlrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\7tthth.exec:\7tthth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vvvjp.exec:\vvvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7vvdj.exec:\7vvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xrfrflr.exec:\xrfrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\bbbhtb.exec:\bbbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\vpvvp.exec:\vpvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\7flxrfr.exec:\7flxrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\5tbhhh.exec:\5tbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\3frrfrf.exec:\3frrfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bhhbnb.exec:\bhhbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ddpvj.exec:\ddpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ddvjd.exec:\ddvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\5ttnhh.exec:\5ttnhh.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pvddj.exec:\pvddj.exe19⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5lrxrxl.exec:\5lrxrxl.exe20⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3btthb.exec:\3btthb.exe21⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1jdpj.exec:\1jdpj.exe22⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jddvd.exec:\jddvd.exe23⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrxrlxx.exec:\rrxrlxx.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\thtbhn.exec:\thtbhn.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ddjdd.exec:\ddjdd.exe26⤵
- Executes dropped EXE
PID:3068 -
\??\c:\flrxxrx.exec:\flrxxrx.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ttntnn.exec:\ttntnn.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jjdjv.exec:\jjdjv.exe29⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5lfflff.exec:\5lfflff.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fxlrrff.exec:\fxlrrff.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhhtbn.exec:\nhhtbn.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pvdjp.exec:\pvdjp.exe33⤵
- Executes dropped EXE
PID:936 -
\??\c:\lfxfflr.exec:\lfxfflr.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9hhnbh.exec:\9hhnbh.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7bbbth.exec:\7bbbth.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3jjdp.exec:\3jjdp.exe37⤵
- Executes dropped EXE
PID:1800 -
\??\c:\llxfffl.exec:\llxfffl.exe38⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hbnbtb.exec:\hbnbtb.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tthhnh.exec:\tthhnh.exe40⤵PID:2132
-
\??\c:\vpvdj.exec:\vpvdj.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnhttt.exec:\bnhttt.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vpdpd.exec:\vpdpd.exe43⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9ddpv.exec:\9ddpv.exe44⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1rxlrrf.exec:\1rxlrrf.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bbbtbn.exec:\bbbtbn.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tnnhhn.exec:\tnnhhn.exe47⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vjpvd.exec:\vjpvd.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vpdpp.exec:\vpdpp.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbthbh.exec:\hbthbh.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bbbttb.exec:\bbbttb.exe52⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7jjvj.exec:\7jjvj.exe53⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dppdd.exec:\dppdd.exe54⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tttnht.exec:\tttnht.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dpjpp.exec:\dpjpp.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pjvdd.exec:\pjvdd.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5lfllxl.exec:\5lfllxl.exe59⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ttbtbt.exec:\ttbtbt.exe60⤵
- Executes dropped EXE
PID:1996 -
\??\c:\btbbth.exec:\btbbth.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9vpvv.exec:\9vpvv.exe62⤵
- Executes dropped EXE
PID:348 -
\??\c:\xflxfrf.exec:\xflxfrf.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hbnhhh.exec:\hbnhhh.exe64⤵
- Executes dropped EXE
PID:308 -
\??\c:\1djdp.exec:\1djdp.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\5pjvj.exec:\5pjvj.exe66⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rllfllr.exec:\rllfllr.exe67⤵PID:2360
-
\??\c:\hbhhhh.exec:\hbhhhh.exe68⤵PID:1984
-
\??\c:\1ntbnb.exec:\1ntbnb.exe69⤵PID:1664
-
\??\c:\vvpdd.exec:\vvpdd.exe70⤵PID:2632
-
\??\c:\llrxrlf.exec:\llrxrlf.exe71⤵PID:2312
-
\??\c:\xrllxfl.exec:\xrllxfl.exe72⤵PID:2140
-
\??\c:\3hthnn.exec:\3hthnn.exe73⤵PID:2244
-
\??\c:\3vdpd.exec:\3vdpd.exe74⤵PID:536
-
\??\c:\xrfllrx.exec:\xrfllrx.exe75⤵PID:1916
-
\??\c:\rrlxffx.exec:\rrlxffx.exe76⤵PID:844
-
\??\c:\hhthth.exec:\hhthth.exe77⤵PID:356
-
\??\c:\ddvjp.exec:\ddvjp.exe78⤵PID:1084
-
\??\c:\jjjvj.exec:\jjjvj.exe79⤵PID:3060
-
\??\c:\lfxfllr.exec:\lfxfllr.exe80⤵PID:1688
-
\??\c:\3rrfrxl.exec:\3rrfrxl.exe81⤵PID:1860
-
\??\c:\bhnhbh.exec:\bhnhbh.exe82⤵PID:2948
-
\??\c:\1vvjp.exec:\1vvjp.exe83⤵PID:848
-
\??\c:\rxxllfl.exec:\rxxllfl.exe84⤵PID:2184
-
\??\c:\1llxfrl.exec:\1llxfrl.exe85⤵PID:2332
-
\??\c:\3nnhnb.exec:\3nnhnb.exe86⤵PID:756
-
\??\c:\5hbthb.exec:\5hbthb.exe87⤵PID:1524
-
\??\c:\vvvvd.exec:\vvvvd.exe88⤵PID:396
-
\??\c:\pjvjv.exec:\pjvjv.exe89⤵PID:1784
-
\??\c:\fxfrlrf.exec:\fxfrlrf.exe90⤵PID:2052
-
\??\c:\hhhnbh.exec:\hhhnbh.exe91⤵PID:2148
-
\??\c:\hnbttt.exec:\hnbttt.exe92⤵PID:3064
-
\??\c:\7dpdv.exec:\7dpdv.exe93⤵PID:2996
-
\??\c:\9xrxxxr.exec:\9xrxxxr.exe94⤵PID:2848
-
\??\c:\5flxfxx.exec:\5flxfxx.exe95⤵PID:2736
-
\??\c:\5bbnbn.exec:\5bbnbn.exe96⤵PID:2716
-
\??\c:\vpjjp.exec:\vpjjp.exe97⤵PID:2732
-
\??\c:\ddvdp.exec:\ddvdp.exe98⤵PID:2812
-
\??\c:\lrfffxf.exec:\lrfffxf.exe99⤵PID:2576
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe100⤵PID:2740
-
\??\c:\bbhnnn.exec:\bbhnnn.exe101⤵PID:2824
-
\??\c:\nnhtbb.exec:\nnhtbb.exe102⤵PID:2588
-
\??\c:\vvdjp.exec:\vvdjp.exe103⤵PID:2568
-
\??\c:\rrllllx.exec:\rrllllx.exe104⤵PID:3008
-
\??\c:\nhbbnn.exec:\nhbbnn.exe105⤵PID:2828
-
\??\c:\ppdjj.exec:\ppdjj.exe106⤵PID:2524
-
\??\c:\pjpdj.exec:\pjpdj.exe107⤵PID:2852
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe108⤵PID:2792
-
\??\c:\fflfflf.exec:\fflfflf.exe109⤵PID:2992
-
\??\c:\ttthtb.exec:\ttthtb.exe110⤵PID:1764
-
\??\c:\bntbnt.exec:\bntbnt.exe111⤵PID:1332
-
\??\c:\3pjpd.exec:\3pjpd.exe112⤵PID:812
-
\??\c:\ddpvp.exec:\ddpvp.exe113⤵PID:2452
-
\??\c:\5xrlrrl.exec:\5xrlrrl.exe114⤵PID:1412
-
\??\c:\bnntht.exec:\bnntht.exe115⤵PID:2340
-
\??\c:\5hbttn.exec:\5hbttn.exe116⤵PID:2604
-
\??\c:\jdvvd.exec:\jdvvd.exe117⤵PID:1748
-
\??\c:\fxxxlrf.exec:\fxxxlrf.exe118⤵PID:1696
-
\??\c:\hhnhnh.exec:\hhnhnh.exe119⤵PID:2076
-
\??\c:\hbthnb.exec:\hbthnb.exe120⤵PID:2060
-
\??\c:\ddpvd.exec:\ddpvd.exe121⤵PID:2632
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe122⤵PID:2940
-
\??\c:\lfxrflx.exec:\lfxrflx.exe123⤵PID:1976
-
\??\c:\xrlrffl.exec:\xrlrffl.exe124⤵PID:1756
-
\??\c:\tnhhbh.exec:\tnhhbh.exe125⤵PID:1168
-
\??\c:\bhnhnt.exec:\bhnhnt.exe126⤵PID:2388
-
\??\c:\5vjjp.exec:\5vjjp.exe127⤵PID:1832
-
\??\c:\7rrflxr.exec:\7rrflxr.exe128⤵PID:2960
-
\??\c:\xlffllr.exec:\xlffllr.exe129⤵PID:1540
-
\??\c:\bbbhbn.exec:\bbbhbn.exe130⤵PID:1084
-
\??\c:\btnbhn.exec:\btnbhn.exe131⤵PID:1556
-
\??\c:\7vpvd.exec:\7vpvd.exe132⤵PID:1864
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe133⤵PID:1860
-
\??\c:\5fxlrrf.exec:\5fxlrrf.exe134⤵PID:2376
-
\??\c:\tnhnbb.exec:\tnhnbb.exe135⤵PID:908
-
\??\c:\hhhnbh.exec:\hhhnbh.exe136⤵PID:988
-
\??\c:\dvpdj.exec:\dvpdj.exe137⤵PID:852
-
\??\c:\vvppj.exec:\vvppj.exe138⤵PID:756
-
\??\c:\fflrfll.exec:\fflrfll.exe139⤵PID:1876
-
\??\c:\9xxflxf.exec:\9xxflxf.exe140⤵PID:2616
-
\??\c:\hhtbnt.exec:\hhtbnt.exe141⤵PID:1708
-
\??\c:\3pdvj.exec:\3pdvj.exe142⤵PID:1256
-
\??\c:\1jdjp.exec:\1jdjp.exe143⤵PID:2252
-
\??\c:\xlxxffl.exec:\xlxxffl.exe144⤵PID:2256
-
\??\c:\llxfrxl.exec:\llxfrxl.exe145⤵PID:2088
-
\??\c:\nhbhtb.exec:\nhbhtb.exe146⤵PID:1456
-
\??\c:\tnbbtt.exec:\tnbbtt.exe147⤵PID:2640
-
\??\c:\dpppd.exec:\dpppd.exe148⤵PID:2928
-
\??\c:\ppdjd.exec:\ppdjd.exe149⤵PID:2272
-
\??\c:\5rrxflx.exec:\5rrxflx.exe150⤵PID:2732
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe151⤵PID:2104
-
\??\c:\tthhnn.exec:\tthhnn.exe152⤵PID:2576
-
\??\c:\jpppp.exec:\jpppp.exe153⤵PID:380
-
\??\c:\vjjdd.exec:\vjjdd.exe154⤵PID:2824
-
\??\c:\llxlxfx.exec:\llxlxfx.exe155⤵PID:2588
-
\??\c:\1htnbb.exec:\1htnbb.exe156⤵PID:2568
-
\??\c:\tbthnn.exec:\tbthnn.exe157⤵PID:3004
-
\??\c:\dvpvd.exec:\dvpvd.exe158⤵PID:2828
-
\??\c:\pjddp.exec:\pjddp.exe159⤵PID:2804
-
\??\c:\rlllrfl.exec:\rlllrfl.exe160⤵PID:2852
-
\??\c:\xxfllrx.exec:\xxfllrx.exe161⤵PID:2636
-
\??\c:\bnbhbt.exec:\bnbhbt.exe162⤵PID:620
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe163⤵PID:300
-
\??\c:\rllxffr.exec:\rllxffr.exe164⤵PID:2428
-
\??\c:\ttnnbh.exec:\ttnnbh.exe165⤵PID:1200
-
\??\c:\nbtttb.exec:\nbtttb.exe166⤵PID:1076
-
\??\c:\vpjvd.exec:\vpjvd.exe167⤵PID:1348
-
\??\c:\jvpjp.exec:\jvpjp.exe168⤵PID:2340
-
\??\c:\fxxxffx.exec:\fxxxffx.exe169⤵PID:2604
-
\??\c:\xxfrrrf.exec:\xxfrrrf.exe170⤵PID:1748
-
\??\c:\tnhntb.exec:\tnhntb.exe171⤵PID:2068
-
\??\c:\9bbhnn.exec:\9bbhnn.exe172⤵PID:316
-
\??\c:\jddpd.exec:\jddpd.exe173⤵PID:2488
-
\??\c:\jjddp.exec:\jjddp.exe174⤵PID:2944
-
\??\c:\rfxxlrr.exec:\rfxxlrr.exe175⤵PID:2092
-
\??\c:\nbnbhb.exec:\nbnbhb.exe176⤵PID:2308
-
\??\c:\tnnbth.exec:\tnnbth.exe177⤵PID:536
-
\??\c:\ppjpp.exec:\ppjpp.exe178⤵PID:1868
-
\??\c:\dvpdj.exec:\dvpdj.exe179⤵PID:408
-
\??\c:\llfxxfx.exec:\llfxxfx.exe180⤵PID:1776
-
\??\c:\5rxlllr.exec:\5rxlllr.exe181⤵PID:1400
-
\??\c:\5bnbhn.exec:\5bnbhn.exe182⤵PID:1780
-
\??\c:\jdppv.exec:\jdppv.exe183⤵PID:1560
-
\??\c:\5pjjp.exec:\5pjjp.exe184⤵PID:1380
-
\??\c:\rfxrrxf.exec:\rfxrrxf.exe185⤵PID:892
-
\??\c:\1fffrxf.exec:\1fffrxf.exe186⤵PID:948
-
\??\c:\tnttbh.exec:\tnttbh.exe187⤵PID:1992
-
\??\c:\hhnbht.exec:\hhnbht.exe188⤵PID:848
-
\??\c:\pvvvd.exec:\pvvvd.exe189⤵PID:2472
-
\??\c:\5dddp.exec:\5dddp.exe190⤵PID:2332
-
\??\c:\xrlxrlr.exec:\xrlxrlr.exe191⤵PID:888
-
\??\c:\nbntnt.exec:\nbntnt.exe192⤵PID:2420
-
\??\c:\dvjvp.exec:\dvjvp.exe193⤵PID:2132
-
\??\c:\pjdjp.exec:\pjdjp.exe194⤵PID:2096
-
\??\c:\rrlrfrx.exec:\rrlrfrx.exe195⤵PID:1616
-
\??\c:\nnnhtb.exec:\nnnhtb.exe196⤵PID:2356
-
\??\c:\nhhbth.exec:\nhhbth.exe197⤵PID:2152
-
\??\c:\5ppdp.exec:\5ppdp.exe198⤵PID:2680
-
\??\c:\jvddd.exec:\jvddd.exe199⤵PID:2720
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe200⤵PID:2716
-
\??\c:\9nhhtb.exec:\9nhhtb.exe201⤵PID:2668
-
\??\c:\5tnbtb.exec:\5tnbtb.exe202⤵PID:2560
-
\??\c:\ddpvv.exec:\ddpvv.exe203⤵PID:2672
-
\??\c:\ddvdv.exec:\ddvdv.exe204⤵PID:2820
-
\??\c:\llfrfrf.exec:\llfrfrf.exe205⤵PID:2548
-
\??\c:\rrrffrx.exec:\rrrffrx.exe206⤵PID:2600
-
\??\c:\hhtbhn.exec:\hhtbhn.exe207⤵PID:2824
-
\??\c:\3vvdp.exec:\3vvdp.exe208⤵PID:2656
-
\??\c:\dvppd.exec:\dvppd.exe209⤵PID:1884
-
\??\c:\5rrrllr.exec:\5rrrllr.exe210⤵PID:2064
-
\??\c:\xrffllx.exec:\xrffllx.exe211⤵PID:2304
-
\??\c:\btntht.exec:\btntht.exe212⤵PID:2864
-
\??\c:\thhbbb.exec:\thhbbb.exe213⤵PID:2900
-
\??\c:\ppdvv.exec:\ppdvv.exe214⤵PID:2876
-
\??\c:\vvvdd.exec:\vvvdd.exe215⤵PID:3000
-
\??\c:\lrfrfxf.exec:\lrfrfxf.exe216⤵PID:2000
-
\??\c:\tnbbhn.exec:\tnbbhn.exe217⤵PID:2008
-
\??\c:\ttbnht.exec:\ttbnht.exe218⤵PID:2452
-
\??\c:\jpdjj.exec:\jpdjj.exe219⤵PID:2344
-
\??\c:\9flrxxf.exec:\9flrxxf.exe220⤵PID:1808
-
\??\c:\1lxrfrf.exec:\1lxrfrf.exe221⤵PID:1716
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe222⤵PID:1604
-
\??\c:\hbbbnb.exec:\hbbbnb.exe223⤵PID:2360
-
\??\c:\tnbnnh.exec:\tnbnnh.exe224⤵PID:1664
-
\??\c:\5jjjp.exec:\5jjjp.exe225⤵PID:2884
-
\??\c:\vpjpd.exec:\vpjpd.exe226⤵PID:1752
-
\??\c:\xrxxffr.exec:\xrxxffr.exe227⤵PID:2772
-
\??\c:\ttnnth.exec:\ttnnth.exe228⤵PID:1264
-
\??\c:\hbtbhh.exec:\hbtbhh.exe229⤵PID:1504
-
\??\c:\ddvdd.exec:\ddvdd.exe230⤵PID:2508
-
\??\c:\pjddv.exec:\pjddv.exe231⤵PID:536
-
\??\c:\3xrxffr.exec:\3xrxffr.exe232⤵PID:320
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe233⤵PID:1568
-
\??\c:\5bbhbb.exec:\5bbhbb.exe234⤵PID:2084
-
\??\c:\thbthh.exec:\thbthh.exe235⤵PID:1400
-
\??\c:\jdppv.exec:\jdppv.exe236⤵PID:2492
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe237⤵PID:1656
-
\??\c:\tnbbtt.exec:\tnbbtt.exe238⤵PID:1100
-
\??\c:\hnbnth.exec:\hnbnth.exe239⤵PID:2236
-
\??\c:\vvvdj.exec:\vvvdj.exe240⤵PID:936
-
\??\c:\dvvvv.exec:\dvvvv.exe241⤵PID:1736
-
\??\c:\lfrrxff.exec:\lfrrxff.exe242⤵PID:2968